Advanced measurement system network intrusion detection method based on twin neural network

Abstract

The invention relates to an advanced measurement system network intrusion detection method based on a twin neural network. The method comprises the following steps: acquiring a target data set associated with an advanced measurement system, and acquiring an initial network intrusion detection model of the advanced measurement system; the initial network intrusion detection model is constructed based on a pre-trained intrusion detection model; performing feature parameter freezing processing and feature fusion processing on the initial network intrusion detection model to obtain a to-be-trained network intrusion detection model; performing iterative training on the network intrusion detection model based on the target data set to obtain a target network intrusion detection model; the target network intrusion detection model is used for performing network intrusion detection processing on the advanced measurement system. By adopting the method, the model performance of the target network intrusion detection model obtained by training the target data set based on the few-label samples can be improved, so that the network intrusion detection accuracy of an advanced measurement system is improved.

Description

Technical Field

[0001] The present application relates to the field of smart grid technology, and in particular to a network intrusion detection method, device, computer equipment, storage medium and computer program product for an advanced measurement system based on a twin neural network. Background Art

[0002] Advanced Metering Infrastructure (AMI) is an important part of the new power system, which greatly promotes the intelligence of the power grid. AMI consists of smart meters (SM), data concentrators (DC), power companies (utilities) and the communication network between the three. AMI has the unique function of realizing the interaction between the user end and the smart grid data management system through a two-way communication network. It is the core component of the smart grid and an important foundation for the interconnection between the power network and the Internet.

[0003] The smart meters in AMI use two-way communication with the data management system to achieve information exchange and assist in grid time-of-use pricing. However, AMI's two-way communication also provides more intrusion points for attackers, which is a potential factor threatening grid security. With the widespread access of a large number of smart terminals and heterogeneous communication links, the risk of cyber attacks is increasing day by day. Therefore, ensuring the security of AMI communications is an important prerequisite for the stable operation of smart grids.

[0004] Anomaly detection based on deep learning has been widely used, but the success of deep learning models depends largely on a large amount of training data and the depth of the model. In the actual application scenarios of power grids, some anomaly categories have only a small amount of data or only a small amount of anomaly data has been labeled, and labeling unlabeled data will consume a lot of time and manpower, resulting in a high cost of training models. Therefore, in actual application scenarios, it is necessary to solve the problem of how to achieve network intrusion detection for AMI with only small samples and reduced model size. Summary of the invention

[0005] Based on this, it is necessary to provide a network intrusion detection method, device, computer equipment, computer-readable storage medium and computer program product for an advanced measurement system based on a twin neural network, which can improve the network intrusion detection effect of the advanced measurement system.

[0006] In a first aspect, the present application provides a network intrusion detection method for an advanced measurement system based on a twin neural network. The method comprises:

[0007] Acquire a target data set associated with an advanced measurement system, and acquire an initial network intrusion detection model of the advanced measurement system; the initial network intrusion detection model is constructed based on a pre-trained intrusion detection model;

[0008] Performing feature parameter freezing and feature fusion processing on the initial network intrusion detection model to obtain a network intrusion detection model to be trained;

[0009] Based on the target data set, the network intrusion detection model is iteratively trained to obtain a target network intrusion detection model; the target network intrusion detection model is used to perform network intrusion detection processing on the advanced measurement system.

[0010] In one embodiment, the initial network intrusion detection model includes at least two sub-models with the same structure and shared weights; the sub-models include multiple convolutional layers; the multiple convolutional layers include shallow convolutional layers and deep convolutional layers; the shallow convolutional layers are used to represent pre-trained convolutional layers; the pre-trained convolutional layers are obtained from the pre-trained intrusion detection model; the deep convolutional layers are used to represent convolutional layers for extracting semantic features;

[0011] The performing feature parameter freezing processing and feature fusion processing on the initial network intrusion detection model to obtain the network intrusion detection model to be trained includes:

[0012] Freezing the characteristic parameters of the shallow convolutional layer to obtain a frozen shallow convolutional layer;

[0013] The deep convolution layer and the frozen shallow convolution layer are subjected to feature fusion processing to obtain the network intrusion detection model to be trained.

[0014] In one embodiment, obtaining the initial network intrusion detection model of the advanced measurement system includes:

[0015] The pre-trained intrusion detection model is obtained according to a network intrusion data set; the labeled samples in the network intrusion data set are more than the labeled samples in the target data set;

[0016] A twin network structure is constructed based on the intrusion detection model to obtain an initial network intrusion detection model of the advanced measurement system.

[0017] In one embodiment, based on the target data set, the network intrusion detection model is iteratively trained to obtain a target network intrusion detection model, including:

[0018] Input at least two samples in the target data set into the network intrusion detection model to obtain a feature vector corresponding to each sample;

[0019] According to the feature vector, a loss value of the network intrusion detection model is obtained;

[0020] According to the loss value, model parameters in the network intrusion detection model except the frozen shallow convolutional layer are iteratively updated to obtain the target network intrusion detection model.

[0021] In one embodiment, obtaining a target data set associated with an advanced measurement system includes:

[0022] Determining an initial data set associated with the advanced measurement system according to a network intrusion type of the advanced measurement system; the initial data set includes non-numerical features;

[0023] The initial data set is preprocessed to obtain the target data set; the target data set does not contain non-numerical features.

[0024] In one embodiment, after obtaining the target network intrusion detection model, the method further includes:

[0025] Obtaining current network data of the advanced measurement system;

[0026] The target network intrusion detection model is used to perform network intrusion detection on the current network data to obtain the network intrusion detection result of the advanced measurement system.

[0027] In a second aspect, the present application also provides a network intrusion detection device for an advanced measurement system based on a twin neural network. The device comprises:

[0028] A preprocessing module, used to obtain a target data set associated with an advanced measurement system, and to obtain an initial network intrusion detection model of the advanced measurement system; the initial network intrusion detection model is constructed based on a pre-trained intrusion detection model;

[0029] A model optimization module, used for performing feature parameter freezing and feature fusion processing on the initial network intrusion detection model to obtain a network intrusion detection model to be trained;

[0030] The model training module is used to iteratively train the network intrusion detection model based on the target data set to obtain a target network intrusion detection model; the target network intrusion detection model is used to perform network intrusion detection processing on the advanced measurement system.

[0031] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0032] Acquire a target data set associated with an advanced measurement system, and acquire an initial network intrusion detection model of the advanced measurement system; the initial network intrusion detection model is constructed based on a pre-trained intrusion detection model;

[0033] Performing feature parameter freezing and feature fusion processing on the initial network intrusion detection model to obtain a network intrusion detection model to be trained;

[0034] Based on the target data set, the network intrusion detection model is iteratively trained to obtain a target network intrusion detection model; the target network intrusion detection model is used to perform network intrusion detection processing on the advanced measurement system.

[0035] In a fourth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0036] Acquire a target data set associated with an advanced measurement system, and acquire an initial network intrusion detection model of the advanced measurement system; the initial network intrusion detection model is constructed based on a pre-trained intrusion detection model;

[0037] Performing feature parameter freezing and feature fusion processing on the initial network intrusion detection model to obtain a network intrusion detection model to be trained;

[0038] Based on the target data set, the network intrusion detection model is iteratively trained to obtain a target network intrusion detection model; the target network intrusion detection model is used to perform network intrusion detection processing on the advanced measurement system.

[0039] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0040] Acquire a target data set associated with an advanced measurement system, and acquire an initial network intrusion detection model of the advanced measurement system; the initial network intrusion detection model is constructed based on a pre-trained intrusion detection model;

[0041] Performing feature parameter freezing and feature fusion processing on the initial network intrusion detection model to obtain a network intrusion detection model to be trained;

[0042] Based on the target data set, the network intrusion detection model is iteratively trained to obtain a target network intrusion detection model; the target network intrusion detection model is used to perform network intrusion detection processing on the advanced measurement system.

[0043] The above-mentioned network intrusion detection method, device, computer equipment, storage medium and computer program product for an advanced measurement system based on a twin neural network obtain a target data set associated with the advanced measurement system, and obtain an initial network intrusion detection model of the advanced measurement system; the initial network intrusion detection model is constructed based on a pre-trained intrusion detection model; the initial network intrusion detection model is subjected to feature parameter freezing and feature fusion processing to obtain a network intrusion detection model to be trained; based on the target data set, the network intrusion detection model is iteratively trained to obtain a target network intrusion detection model; the target network intrusion detection model is used to perform network intrusion detection processing on the advanced measurement system. By adopting this method, an initial network intrusion detection model is constructed based on a pre-trained intrusion detection model. The pre-trained knowledge in the intrusion detection model can also be transferred to the initial network intrusion detection model, which helps to improve the processing ability of the model under a small number of samples. The feature parameter freezing process is used to retain the knowledge learned in the pre-training, accelerate the model training process, and the feature fusion process is used to provide richer feature information, which can better capture the feature information of the input data, make the model more generalized, and improve the accuracy of the model. While effectively improving the model performance of the target network intrusion detection model trained based on the target data set of few label samples, it also saves a lot of computing resources and time overhead, accelerates the model training process, and thus improves the accuracy of network intrusion detection for advanced measurement systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 It is a flowchart of a network intrusion detection method of an advanced measurement system based on a twin neural network in one embodiment;

[0045] Figure 2 It is a flowchart of the steps of freezing feature parameters and fusing features for an initial network intrusion detection model in one embodiment;

[0046] Figure 3 It is a flowchart of a network intrusion detection method of an advanced measurement system based on a twin neural network in another embodiment;

[0047] Figure 4 A schematic diagram of a target network intrusion detection model in one embodiment;

[0048] Figure 5 It is a structural block diagram of a network intrusion detection device of an advanced measurement system based on a twin neural network in one embodiment;

[0049] Figure 6 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0051] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0052] In one embodiment, Figure 1 As shown, a network intrusion detection method for an advanced measurement system based on a twin neural network is provided. This embodiment takes the method applied to a server as an example. It can be understood that the method can also be applied to a terminal, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. Among them, the server can be implemented as an independent server or a server cluster composed of multiple servers. The terminal can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices, and portable wearable devices. In this embodiment, the method includes the following steps:

[0053] Step S101, obtaining a target data set associated with an advanced measurement system, and obtaining an initial network intrusion detection model of the advanced measurement system; the initial network intrusion detection model is constructed based on a pre-trained intrusion detection model.

[0054] Among them, the target dataset is used to characterize the network intrusion dataset with few labeled samples.

[0055] Among them, the intrusion detection model can be constructed based on Convolutional Neural Networks (CNN).

[0056] Specifically, the network structure of the Advanced Metering Infrastructure (AMI) includes home area network, neighborhood area network and wide area network; matching data sets can be selected as initial data sets based on the types of network attacks that the home area network, neighborhood area network and wide area network are vulnerable to. The server can perform preprocessing such as data cleaning, feature digitization, feature optimization, and numerical normalization on the initial data set to improve the quality of the data set, and then the server obtains the target data set. The server can also use the pre-trained intrusion detection model to build the initial network intrusion detection model of the advanced measurement system.

[0057] It should be noted that both the intrusion detection model and the target network intrusion detection model are deep learning models used to detect network intrusions, but the intrusion detection model is trained based on a conventional network intrusion dataset, while the target network intrusion detection model is trained based on a network intrusion dataset that is closely related to the advanced measurement system (such as the target dataset); although the number of labeled samples in the conventional network intrusion dataset is large, the degree of correlation with the advanced measurement system is relatively low, so it is necessary to further construct and train the target network intrusion detection model so that the target network intrusion detection model can be used to more accurately detect the network intrusion of the advanced measurement system.

[0058] Step S102, performing feature parameter freezing processing and feature fusion processing on the initial network intrusion detection model to obtain the network intrusion detection model to be trained.

[0059] The server can further optimize the initial network intrusion detection model through feature parameter freezing and feature fusion processing. Specifically, the server can freeze the feature parameters of the convolutional layer that has been fully trained in advance in the sub-model of the initial network intrusion detection model, that is, directly use the model parameters of the convolutional layer in the pre-trained intrusion detection model; and also fuse the features of the frozen convolutional layer output and the features of the unfrozen convolutional layer, thereby constructing the network intrusion detection model to be trained.

[0060] Step S103, iteratively training the network intrusion detection model based on the target data set to obtain a target network intrusion detection model; the target network intrusion detection model is used to perform network intrusion detection processing on the advanced measurement system.

[0061] Specifically, the server can divide the target data set into a training set and a test set, use the training set to train the network intrusion detection model, use the gradient descent algorithm to optimize the model parameters of the network intrusion detection model, and calculate the accuracy of the model after each round (epoch) of training. After the training is completed, the target network intrusion detection model is obtained.

[0062] In the above-mentioned network intrusion detection method for an advanced measurement system based on a twin neural network, a target data set associated with the advanced measurement system is obtained, and an initial network intrusion detection model of the advanced measurement system is obtained; the initial network intrusion detection model is constructed based on a pre-trained intrusion detection model; the initial network intrusion detection model is subjected to feature parameter freezing and feature fusion processing to obtain a network intrusion detection model to be trained; based on the target data set, the network intrusion detection model is iteratively trained to obtain a target network intrusion detection model; the target network intrusion detection model is used to perform network intrusion detection processing on the advanced measurement system. By adopting this method, an initial network intrusion detection model is constructed based on a pre-trained intrusion detection model. The pre-trained knowledge in the intrusion detection model can also be transferred to the initial network intrusion detection model, which helps to improve the processing ability of the model under a small number of samples. The feature parameter freezing process is used to retain the knowledge learned in the pre-training, accelerate the model training process, and the feature fusion process is used to provide richer feature information, which can better capture the feature information of the input data, make the model more generalized, and improve the accuracy of the model. While effectively improving the model performance of the target network intrusion detection model trained based on the target data set of few label samples, it also saves a lot of computing resources and time overhead, accelerates the model training process, and thus improves the accuracy of network intrusion detection for advanced measurement systems.

[0063] In one embodiment, the initial network intrusion detection model includes at least two sub-models with the same structure and shared weights; the sub-models include multiple convolutional layers; the multiple convolutional layers include shallow convolutional layers and deep convolutional layers; the shallow convolutional layers are used to represent the pre-trained convolutional layers; the pre-trained convolutional layers are obtained from the pre-trained intrusion detection model; the deep convolutional layers are used to represent the convolutional layers for extracting semantic features. Figure 2 As shown, the above step S102, performing feature parameter freezing processing and feature fusion processing on the initial network intrusion detection model to obtain the network intrusion detection model to be trained, specifically includes the following contents:

[0064] Step S201, freezing the feature parameters of the shallow convolutional layer to obtain a frozen shallow convolutional layer.

[0065] Specifically, a shallow convolutional layer refers to a convolutional layer that has been fully trained in advance and has good feature extraction capabilities. For example, if the convolutional layer in the pre-trained intrusion detection model has been fully trained in advance and has good feature extraction capabilities, then the model parameters of the convolutional layer in the pre-trained intrusion detection model can be transferred to the shallow convolutional layer in the initial network intrusion detection model through transfer learning, so that the shallow convolutional layer retains the knowledge learned in the pre-trained intrusion detection model; then the server can freeze the feature parameters of the shallow convolutional layer in the shared sub-model in the initial network intrusion detection model to obtain a frozen shallow convolutional layer, that is, the frozen shallow convolutional layer does not update its model parameters during the training process, which helps to save the training time of the shallow convolutional layer, thereby accelerating the training process of the network intrusion detection model.

[0066] Step S202, performing feature fusion processing on the deep convolution layer and the frozen shallow convolution layer to obtain a network intrusion detection model to be trained.

[0067] It can be understood that the multiple convolutional layers of the sub-model may include some common convolutional layers in addition to shallow convolutional layers and deep convolutional layers.

[0068] Specifically, since there are many convolutional layers in the sub-model, the features that can be obtained by each convolutional layer in the sub-model are also very different. The shallow convolutional layer is more focused on extracting some shallow feature information such as color and edge, while the deep convolutional layer is more focused on the semantic features of the target. The server can perform feature fusion on the features output by the deep convolutional layer and the features output by the frozen shallow convolutional layer, and then the server obtains the network intrusion detection model to be trained.

[0069] For example, suppose the shared sub-model in the initial network intrusion detection model is CNN. CNN usually includes convolutional layers, pooling layers, and fully connected layers, and extracts input data features through forward propagation. Assume that the sub-model CNN has 8 convolutional layers (i.e., conv1, conv2, conv3, conv4, conv5, conv6, conv7, and conv8). Assume that the shallow convolutional layers are conv1, conv2, and conv3, and the deep convolutional layers are conv4, conv5, and conv8, then the server can freeze the model parameters of conv1, conv2, and conv3, and only update the model parameters of other layers. It also fuses the frozen output features of conv1, conv2, and conv3 with the output features of conv4, conv5, and conv8 to form a better feature representation. Different features can provide more information, making the model more generalized. When some features fail, other features can make up for their shortcomings. In addition, a one-dimensional convolution function conv1d is used for convolution. There is an activation layer after each convolution layer (considering that the values ​​of AMI communication information are all non-negative, in order to improve the convergence speed of the neural network, the present invention takes the ReLU activation function as an example), the neuron activation value is set to 0.2-0.5, the number of filters is 8-32, and the convolution kernel size is 2-10. After the pooling layer calculates the results. Continue to enter the next convolution pooling layer to cycle the above process multiple times, the filter size increases successively, the convolution kernel size remains unchanged, the pooling layer setting remains unchanged, and after multiple convolution pooling is completed, enter the fully connected layer.

[0070] In this embodiment, feature parameter freezing is also used to retain the knowledge learned in pre-training, accelerate the model training process, control the learning range of the model, save a lot of computing resources and time, accelerate the model training process, and reduce the risk of model overfitting and improve the generalization ability of the model. By using feature fusion processing to provide richer feature information, it is possible to better capture the feature information of the input data, make the model more generalized, and improve the accuracy of the model. By using multiple features, the risk of model overfitting can be further reduced, thereby greatly improving the model performance of the target network intrusion detection model obtained based on network intrusion detection model training.

[0071] In one embodiment, the above step S101, obtaining an initial network intrusion detection model of an advanced measurement system, specifically includes the following contents: obtaining a pre-trained intrusion detection model based on a network intrusion data set; the number of labeled samples in the network intrusion data set is greater than the number of labeled samples in the target data set; and constructing a twin network structure based on the intrusion detection model to obtain an initial network intrusion detection model of the advanced measurement system.

[0072] Among them, the network intrusion dataset can be a large public dataset, for example, the network intrusion dataset can be CIC-MalMem-2022 (a dataset specifically used to detect malicious memory modification techniques).

[0073] Specifically, the server can use the network intrusion data set to pre-train an untrained intrusion detection model (such as CNN) to obtain a pre-trained intrusion detection model. Then, the server can build the intrusion detection model into an initial network intrusion detection model based on a twin network structure, such as a Siamese network. For example, the intrusion detection model can be used as a shared sub-model in the twin neural network.

[0074] In this embodiment, an initial network intrusion detection model is constructed by a pre-trained intrusion detection model, and the pre-trained knowledge in the intrusion detection model can be transferred to the initial network intrusion detection model, thereby improving the training effect of the model under the target data set of few-label samples of the advanced measurement system, thereby improving the model's network intrusion detection capabilities for the advanced measurement system.

[0075] In one embodiment, the above step S103, based on the target data set, iteratively trains the network intrusion detection model to obtain the target network intrusion detection model, specifically including the following contents: at least two samples in the target data set are input into the network intrusion detection model to obtain a feature vector corresponding to each sample; based on the feature vector, a loss value of the network intrusion detection model is obtained; based on the loss value, the model parameters of the network intrusion detection model except the frozen shallow convolutional layer are iteratively updated to obtain the target network intrusion detection model.

[0076] Specifically, during the training of the network intrusion detection model, the number of samples input each time is the same as the number of sub-models shared in the network intrusion detection model; for example, if there are two shared sub-models in the network intrusion detection model, two samples are input each time, and the two samples can be from the same category or different categories. Through the sub-models shared in the network intrusion detection model, one sample is processed respectively, such as performing feature extraction on the sample, and the server obtains the feature vector corresponding to each sample. The server can use the contrastive loss function as the loss function of the network intrusion detection model; wherein the goal of the contrastive loss function is to make samples from the same category (positive samples) closer in the feature space, while distinguishing samples from different categories (negative samples). The server uses the contrastive loss function to calculate the loss value corresponding to the output feature vector, and then uses the loss value to update the model parameters of the network intrusion detection model except the model parameters of the frozen shallow convolution layer. After multiple iterations of training, the server obtains the target network intrusion detection model.

[0077] In practical applications, the server can also calculate the distance between at least two feature vectors output by the Euclidean distance algorithm, such as the torch framework function: torch.nn.functional.pairwise_distance(x1, x2, p=2, eps=10-06). The calculation formula of the one-dimensional Euclidean distance can be simplified as:

[0078]

[0079] Where D(x, y) represents the one-dimensional Euclidean distance between feature x and feature y, that is, the absolute difference between the two values.

[0080] Assume that the output set of one-dimensional feature vectors is (X a , X b ), the Euclidean distance between these two eigenvectors is expressed as , then the loss value can be expressed as:

[0081]

[0082] Where y represents (X a , X b ) matches, 1 if matched and 0 if not matched; m is the set safety distance. a , X b ) is less than m, the loss value will become 0, which makes the model update the target X a and X b It is similar rather than identical, thus ensuring the generalization ability of the model.

[0083] In this embodiment, the contrast loss function is used to implement effective training of the network intrusion detection model, thereby improving the model accuracy of the target network intrusion detection model.

[0084] In one embodiment, the above step S101, obtaining a target data set associated with the advanced measurement system, specifically includes the following contents: determining an initial data set associated with the advanced measurement system according to the network intrusion type of the advanced measurement system; the initial data set contains non-numerical features; preprocessing the initial data set to obtain a target data set; the target data set does not contain non-numerical features.

[0085] Specifically, the server can determine the initial data set associated with the advanced measurement system according to the network intrusion type of the advanced measurement system. For example, the home area network of the advanced measurement system is mainly based on low-speed short-distance communication, which is vulnerable to denial of service attacks (Denial of Service, Dos) and port monitoring or scanning (Probing) attacks. The neighborhood area network is used to aggregate smart meter data and is vulnerable to unauthorized access to local permissions attacks (User-to-Root, U2R). The wide area network is mainly based on high-speed long-distance communication, and the transmitted data information is relatively sensitive, which is vulnerable to unauthorized remote access attacks (Remote-to-Login, R2L). Therefore, the server can select the NSL-KDD data set as the initial data set associated with the advanced measurement system. The NSL-KDD data set contains the above four types of attacks suffered by the advanced measurement system.

[0086] Furthermore, the server can preprocess the initial data set, including: 1) performing data cleaning on the initial data set to remove duplicate or incomplete invalid data in the initial data set. 2) performing numerical processing on the initial data set, wherein the numerical processing includes feature numerical processing and label numerical processing. Each data in the NSL-KDD data set contains a 3D symbol feature and a label bit. The non-numerical features in the NSL-KDD data set are protocol_type, service and flag. Among them, protocol_type contains three attributes of tcp, udp and icmp, which are represented by 0, 1 and 2 respectively after numerical processing. Similarly, service contains 70 attributes, represented by 0~69, and flag contains 11 attributes, represented by 0~10, that is, the symbol feature can be processed and mapped into a digital feature after numerical processing; in addition, in the initial data set, the communication data is divided into 5 categories, namely normal and 4 attack types. 3) Perform feature optimization on the initial data set, use the random forest algorithm to calculate the feature importance of the initial data set, and sort the resulting redundant features according to the feature importance to reduce the interference of redundant features on model detection. 4) The feature value ranges in the initial data set vary greatly. If the normalized values ​​in the initial data set are directly used for training, the effect of high-value features will be amplified. In order to eliminate the impact of excessive feature differences, the features are normalized and evenly mapped to the [0, 1] interval without changing the feature weights. The specific calculation formula is:

[0087]

[0088] In the formula, x* is the normalized eigenvalue, x is the original eigenvalue, and x max is the maximum value of the feature, x min is the minimum value of the feature.

[0089] In this embodiment, by performing preprocessing such as data cleaning, text digitization, feature optimization, and numerical normalization on the initial data set, the data quality of the processed target data set can be improved, thereby ensuring that the model can correctly identify and process data during the training process and improving the training effect of the model.

[0090] In one embodiment, after obtaining the target network intrusion detection model in the above step S103, it also includes: obtaining current network data of the advanced measurement system; performing network intrusion detection on the current network data through the target network intrusion detection model to obtain the network intrusion detection result of the advanced measurement system.

[0091] In actual applications, the server can collect the current network data of the advanced measurement system in real time, and input the current network data into the target network intrusion detection model to perform network intrusion detection on the current network data through the target network intrusion detection model, and output the network intrusion detection results of the advanced measurement system. Among them, the network intrusion detection results can be normal or four types of attacks: Dos, Probing, U2R, and R2L.

[0092] In this embodiment, after the target network intrusion detection model is trained, the target network intrusion detection model can also be used to perform network intrusion detection on advanced measurement systems in smart grid scenarios, thereby improving the accuracy of network intrusion detection on advanced measurement systems.

[0093] In one embodiment, Figure 3 As shown, another advanced measurement system network intrusion detection method based on twin neural network is provided. Taking the application of this method to a server as an example, the method includes the following steps:

[0094] Step S301, obtaining a target data set associated with an advanced measurement system, and obtaining an initial network intrusion detection model of the advanced measurement system; the initial network intrusion detection model is constructed based on a pre-trained intrusion detection model.

[0095] Step S302, performing feature parameter freezing processing and feature fusion processing on the initial network intrusion detection model to obtain the network intrusion detection model to be trained.

[0096] Step S303: input at least two samples in the target data set into the network intrusion detection model to obtain a feature vector corresponding to each sample.

[0097] Step S304, obtaining the loss value of the network intrusion detection model according to the feature vector; and iteratively updating the model parameters except the frozen shallow convolutional layer in the network intrusion detection model according to the loss value to obtain the target network intrusion detection model.

[0098] Step S305: obtaining current network data of the advanced measurement system.

[0099] Step S306, performing network intrusion detection on the current network data through the target network intrusion detection model to obtain the network intrusion detection result of the advanced measurement system.

[0100] The above-mentioned network intrusion detection method for advanced measurement systems based on twin neural networks can achieve the following beneficial effects: an initial network intrusion detection model is constructed based on a pre-trained intrusion detection model, and the pre-trained knowledge in the intrusion detection model can also be transferred to the initial network intrusion detection model, which helps to improve the model's processing capabilities under few samples; it also uses feature parameter freezing processing to retain the knowledge learned in pre-training, accelerates the model training process, and uses feature fusion processing to provide richer feature information, which can better capture the feature information of the input data, make the model more generalized, and improve the accuracy of the model. While effectively improving the model performance of the target network intrusion detection model trained based on the target data set with few label samples, it also saves a lot of computing resources and time overhead, accelerates the model training process, and thus improves the accuracy of network intrusion detection for advanced measurement systems.

[0101] In order to more clearly illustrate the advanced measurement system network intrusion detection method based on twin neural networks provided by the embodiments of the present disclosure, the above-mentioned advanced measurement system network intrusion detection method based on twin neural networks is specifically described below with a specific embodiment. Figure 4 This is a schematic diagram of the framework of the target network intrusion detection model, and provides another advanced measurement system network intrusion detection method based on twin neural networks, which can be applied to servers, including the following contents:

[0102] (1) Dataset selection:

[0103] The NSL-KDD dataset is selected as the initial dataset of AMI.

[0104] (2) Dataset preprocessing:

[0105] Since each data in the NSL-KDD dataset contains a 3D symbol feature and a label bit, the deep learning algorithm cannot process non-numerical features. It is necessary to perform preprocessing operations such as digitization, feature selection, and normalization on the dataset to obtain the target dataset.

[0106] (3) Pre-trained model:

[0107] The pre-trained model is obtained by pre-training on a deep convolutional neural network (such as CNN) based on a large public dataset (such as CIC-MalMem-2022).

[0108] (4) Construction of twin neural network model:

[0109] 41) Improve the submodules in the twin neural network model, taking the deep convolutional neural network (CNN) as an example:

[0110] The CNN network contains multiple convolutional layers. The first few layers are used to extract shallow features. The more layers there are, the deeper features can be extracted. The first few layers (the first three layers are used as an example) are frozen and the pre-trained model parameters in (3) are directly used through transfer learning. The latter layers (the fifth layer is used as an example) are optimized using fusion feature fusion, such as using the feature fusion of the fourth, fifth and final output eighth layers. This improves the generalization ability and accuracy of the model while saving computing resources and time overhead.

[0111] 42) Calculation of feature distance of input samples:

[0112] During the training of the twin neural network model, two samples from the target data set are input each time. The two samples can be from the same category or different categories. After the twin neural network model is passed, two feature vectors are output. For each output of two feature vectors, the distance between the two features is calculated using the Euclidean distance algorithm.

[0113] 43) Loss loss function:

[0114] Use a loss function (such as Contrastive Loss) to measure the similarity between the two output features.

[0115] (5) Training and validation:

[0116] Before training the twin neural network model, you need to load the data and divide it into training and test sets. Then, use the gradient descent algorithm to optimize the parameters and calculate the loss value and accuracy of the model at the end of each epoch.

[0117] In this embodiment, the transfer learning technology is used to reduce the complexity of the model. The freeze feature freezing technology is used. The shallow layer of the pre-trained network model has been fully trained and has good feature extraction capabilities. The shallow feature parameters of the network are frozen and only the parameters of other layers are updated. The learned knowledge can be retained and the learning process of the model on the task can be accelerated. The fusion feature fusion technology is used. Different features can provide more information, making the model more generalized, and can improve the accuracy, performance and expression of the model classification, so as to better capture the information of the data, control the learning scope of the model, save a lot of computing resources and time overhead, and accelerate the training process of the model. These technologies are used to improve the efficiency of the model and reduce the complexity of the model, and at the same time, a higher accuracy is obtained in detecting the abnormal communication status of AMI including Normal and four attacks Dos, Probing, R2L, and U2R.

[0118] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0119] Based on the same inventive concept, the embodiment of the present application also provides an advanced measurement system network intrusion detection device based on a twin neural network for implementing the advanced measurement system network intrusion detection method based on a twin neural network involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more embodiments of the advanced measurement system network intrusion detection device based on a twin neural network provided below can refer to the limitations of the advanced measurement system network intrusion detection method based on a twin neural network above, and will not be repeated here.

[0120] In one embodiment, Figure 5 As shown, a network intrusion detection device 500 of an advanced measurement system based on a twin neural network is provided, comprising: a preprocessing module 501, a model optimization module 502 and a model training module 503, wherein:

[0121] The preprocessing module 501 is used to obtain a target data set associated with the advanced measurement system and to obtain an initial network intrusion detection model of the advanced measurement system; the initial network intrusion detection model is constructed based on a pre-trained intrusion detection model.

[0122] The model optimization module 502 is used to perform feature parameter freezing and feature fusion processing on the initial network intrusion detection model to obtain the network intrusion detection model to be trained.

[0123] The model training module 503 is used to iteratively train the network intrusion detection model based on the target data set to obtain a target network intrusion detection model; the target network intrusion detection model is used to perform network intrusion detection processing on the advanced measurement system.

[0124] In one embodiment, the initial network intrusion detection model includes at least two sub-models with the same structure and shared weights; the sub-model includes multiple convolutional layers; the multiple convolutional layers include shallow convolutional layers and deep convolutional layers; the shallow convolutional layers are used to represent the pre-trained convolutional layers; the pre-trained convolutional layers are obtained from the pre-trained intrusion detection model; the deep convolutional layers are used to represent the convolutional layers for extracting semantic features. The model optimization module 502 is also used to freeze the feature parameters of the shallow convolutional layers to obtain the frozen shallow convolutional layers; perform feature fusion processing on the deep convolutional layers and the frozen shallow convolutional layers to obtain the network intrusion detection model to be trained.

[0125] In one embodiment, the preprocessing module 501 is also used to obtain a pre-trained intrusion detection model based on a network intrusion data set; the number of labeled samples in the network intrusion data set is greater than the number of labeled samples in the target data set; a twin network structure is constructed based on the intrusion detection model to obtain an initial network intrusion detection model of the advanced measurement system.

[0126] In one embodiment, the model training module 503 is also used to input at least two samples in the target data set into the network intrusion detection model to obtain a feature vector corresponding to each sample; based on the feature vector, a loss value of the network intrusion detection model is obtained; based on the loss value, the model parameters of the network intrusion detection model except for the frozen shallow convolutional layer are iteratively updated to obtain the target network intrusion detection model.

[0127] In one embodiment, the preprocessing module 501 is also used to determine an initial data set associated with the advanced measurement system according to the network intrusion type of the advanced measurement system; the initial data set includes non-numerical features; the initial data set is preprocessed to obtain a target data set; the target data set does not include non-numerical features.

[0128] In one embodiment, the advanced measurement system network intrusion detection device 500 based on the twin neural network also includes an intrusion detection module, which is used to obtain the current network data of the advanced measurement system; through the target network intrusion detection model, the current network data is subjected to network intrusion detection data to obtain the network intrusion detection result of the advanced measurement system.

[0129] Each module in the network intrusion detection device of the advanced measurement system based on twin neural network can be implemented in whole or in part by software, hardware and their combination. Each module can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to each module above.

[0130] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 6 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data such as target data sets and network intrusion detection results. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a network intrusion detection method of an advanced measurement system based on a twin neural network is implemented.

[0131] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0132] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0133] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0134] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0135] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0136] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0137] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be construed as limiting the scope of the present application. It should be noted that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A network intrusion detection method for an advanced measurement system based on a twin neural network, characterized in that: The method comprises: Acquire a target data set associated with an advanced measurement system, and acquire an initial network intrusion detection model of the advanced measurement system; the initial network intrusion detection model is constructed based on a pre-trained intrusion detection model; Performing feature parameter freezing and feature fusion processing on the initial network intrusion detection model to obtain a network intrusion detection model to be trained; Based on the target data set, the network intrusion detection model is iteratively trained to obtain a target network intrusion detection model; the target network intrusion detection model is used to perform network intrusion detection processing on the advanced measurement system.

2. The method according to claim 1, characterized in that The initial network intrusion detection model comprises at least two sub-models with the same structure and shared weights; the sub-model comprises a plurality of convolutional layers; the plurality of convolutional layers comprises a shallow convolutional layer and a deep convolutional layer; the shallow convolutional layer is used to represent the pre-trained convolutional layer; the pre-trained convolutional layer is obtained by the pre-trained intrusion detection model; the deep convolutional layer is used to represent the convolutional layer for extracting semantic features; The performing feature parameter freezing processing and feature fusion processing on the initial network intrusion detection model to obtain the network intrusion detection model to be trained includes: Freezing the characteristic parameters of the shallow convolutional layer to obtain a frozen shallow convolutional layer; The deep convolution layer and the frozen shallow convolution layer are subjected to feature fusion processing to obtain the network intrusion detection model to be trained.

3. The method according to claim 2, characterized in that The step of obtaining the initial network intrusion detection model of the advanced measurement system includes: The pre-trained intrusion detection model is obtained according to a network intrusion data set; the labeled samples in the network intrusion data set are more than the labeled samples in the target data set; A twin network structure is constructed based on the intrusion detection model to obtain an initial network intrusion detection model of the advanced measurement system.

4. The method according to claim 2, characterized in that The iterative training of the network intrusion detection model based on the target data set to obtain a target network intrusion detection model includes: Input at least two samples in the target data set into the network intrusion detection model to obtain a feature vector corresponding to each sample; According to the feature vector, a loss value of the network intrusion detection model is obtained; According to the loss value, model parameters in the network intrusion detection model except the frozen shallow convolutional layer are iteratively updated to obtain the target network intrusion detection model.

5. The method according to claim 1, characterized in that The step of obtaining a target data set associated with the advanced measurement system includes: Determining an initial data set associated with the advanced measurement system according to a network intrusion type of the advanced measurement system; the initial data set includes non-numerical features; The initial data set is preprocessed to obtain the target data set; the target data set does not contain non-numerical features.

6. The method according to claim 1, characterized in that After obtaining the target network intrusion detection model, it also includes: Obtaining current network data of the advanced measurement system; The target network intrusion detection model is used to perform network intrusion detection on the current network data to obtain the network intrusion detection result of the advanced measurement system.

7. A network intrusion detection device for an advanced measurement system based on a twin neural network, characterized in that: The device comprises: A preprocessing module, used to obtain a target data set associated with an advanced measurement system, and to obtain an initial network intrusion detection model of the advanced measurement system; the initial network intrusion detection model is constructed based on a pre-trained intrusion detection model; A model optimization module, used for performing feature parameter freezing and feature fusion processing on the initial network intrusion detection model to obtain a network intrusion detection model to be trained; The model training module is used to iteratively train the network intrusion detection model based on the target data set to obtain a target network intrusion detection model; the target network intrusion detection model is used to perform network intrusion detection processing on the advanced measurement system.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images